Sourced from urllib3's releases.
2.6.0
🚀 urllib3 is fundraising for HTTP/2 support
urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.
Thank you for your support.
Security
- Fixed a security issue where streaming API could improperly handle highly compressed HTTP content ("decompression bombs") leading to excessive resource consumption even when a small amount of data was requested. Reading small chunks of compressed data is safer and much more efficient now. (CVE-2025-66471 reported by
@​Cycloctane, 8.9 High, GHSA-2xpw-w6gg-jr37)- Fixed a security issue where an attacker could compose an HTTP response with virtually unlimited links in the
Content-Encodingheader, potentially leading to a denial of service (DoS) attack by exhausting system resources during decoding. The number of allowed chained encodings is now limited to 5. (CVE-2025-66418 reported by@​illia-v, 8.9 High, GHSA-gm62-xv2j-4w53)[!IMPORTANT]
- If urllib3 is not installed with the optional
urllib3[brotli]extra, but your environment contains a Brotli/brotlicffi/brotlipy package anyway, make sure to upgrade it to at least Brotli 1.2.0 or brotlicffi 1.2.0.0 to benefit from the security fixes and avoid warnings. Prefer usingurllib3[brotli]to install a compatible Brotli package automatically.- If you use custom decompressors, please make sure to update them to respect the changed API of
urllib3.response.ContentDecoder.Features
- Enabled retrieval, deletion, and membership testing in
HTTPHeaderDictusing bytes keys. (#3653)- Added host and port information to string representations of
HTTPConnection. (#3666)- Added support for Python 3.14 free-threading builds explicitly. (#3696)
Removals
- Removed the
HTTPResponse.getheaders()method in favor ofHTTPResponse.headers. Removed theHTTPResponse.getheader(name, default)method in favor ofHTTPResponse.headers.get(name, default). (#3622)Bugfixes
- Fixed redirect handling in
urllib3.PoolManagerwhen an integer is passed for the retries parameter. (#3649)- Fixed
HTTPConnectionPoolwhen used in Emscripten with no explicit port. (#3664)- Fixed handling of
SSLKEYLOGFILEwith expandable variables. (#3700)Misc
- Changed the
zstdextra to installbackports.zstdinstead ofzstandardon Python 3.13 and before. (#3693)- Improved the performance of content decoding by optimizing
BytesQueueBufferclass. (#3710)- Allowed building the urllib3 package with newer setuptools-scm v9.x. (#3652)
- Ensured successful urllib3 builds by setting Hatchling requirement to ≥ 1.27.0. (#3638)
Sourced from urllib3's changelog.
2.6.0 (2025-12-05)
Security
- Fixed a security issue where streaming API could improperly handle highly compressed HTTP content ("decompression bombs") leading to excessive resource consumption even when a small amount of data was requested. Reading small chunks of compressed data is safer and much more efficient now. (
GHSA-2xpw-w6gg-jr37 <https://github.com/urllib3/urllib3/security/advisories/GHSA-2xpw-w6gg-jr37>__)- Fixed a security issue where an attacker could compose an HTTP response with virtually unlimited links in the
Content-Encodingheader, potentially leading to a denial of service (DoS) attack by exhausting system resources during decoding. The number of allowed chained encodings is now limited to 5. (GHSA-gm62-xv2j-4w53 <https://github.com/urllib3/urllib3/security/advisories/GHSA-gm62-xv2j-4w53>__).. caution::
If urllib3 is not installed with the optional
urllib3[brotli]extra, but your environment contains a Brotli/brotlicffi/brotlipy package anyway, make sure to upgrade it to at least Brotli 1.2.0 or brotlicffi 1.2.0.0 to benefit from the security fixes and avoid warnings. Prefer usingurllib3[brotli]to install a compatible Brotli package automatically.If you use custom decompressors, please make sure to update them to respect the changed API of
urllib3.response.ContentDecoder.Features
- Enabled retrieval, deletion, and membership testing in
HTTPHeaderDictusing bytes keys. ([#3653](https://github.com/urllib3/urllib3/issues/3653) <https://github.com/urllib3/urllib3/issues/3653>__)- Added host and port information to string representations of
HTTPConnection. ([#3666](https://github.com/urllib3/urllib3/issues/3666) <https://github.com/urllib3/urllib3/issues/3666>__)- Added support for Python 3.14 free-threading builds explicitly. (
[#3696](https://github.com/urllib3/urllib3/issues/3696) <https://github.com/urllib3/urllib3/issues/3696>__)Removals
- Removed the
HTTPResponse.getheaders()method in favor ofHTTPResponse.headers. Removed theHTTPResponse.getheader(name, default)method in favor ofHTTPResponse.headers.get(name, default). ([#3622](https://github.com/urllib3/urllib3/issues/3622) <https://github.com/urllib3/urllib3/issues/3622>__)Bugfixes
- Fixed redirect handling in
urllib3.PoolManagerwhen an integer is passed for the retries parameter. ([#3649](https://github.com/urllib3/urllib3/issues/3649) <https://github.com/urllib3/urllib3/issues/3649>__)- Fixed
HTTPConnectionPoolwhen used in Emscripten with no explicit port. ([#3664](https://github.com/urllib3/urllib3/issues/3664) <https://github.com/urllib3/urllib3/issues/3664>__)- Fixed handling of
SSLKEYLOGFILEwith expandable variables. ([#3700](https://github.com/urllib3/urllib3/issues/3700) <https://github.com/urllib3/urllib3/issues/3700>__)
... (truncated)
720f484
Release 2.6.024d7b67
Merge commit from forkc19571d
Merge commit from fork816fcf0
Bump actions/setup-python from 6.0.0 to 6.1.0 (#3725)18af0a1
Improve speed of BytesQueueBuffer.get() by using memoryview
(#3711)1f6abac
Bump versions of pre-commit hooks (#3716)1c8fbf7
Bump actions/checkout from 5.0.0 to 6.0.0 (#3722)7784b9e
Add Python 3.15 to CI (#3717)0241c9e
Updated docs to reflect change in optional zstd dependency from
zstandard t...7afcabb
Expand environment variable of SSLKEYLOGFILE (#3705)